{"data":{"id":"8dc40ad0-cd2f-4645-99a2-b0f5398ad296","title":"GHSA-gg5m-55jj-8m5g: Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters","summary":"Graphiti versions 0.28.1 and earlier contained a Cypher injection flaw in shared search-filter construction for non-Kuzu backends. Attacker-controlled values in SearchFilters.node_labels were concatenated directly into Cypher label expressions, and in MCP deployments an LLM client could be steered via prompt injection into calling search_nodes with crafted entity_types values. Affected backends were Neo4j, FalkorDB, and Neptune; successful exploitation could read, modify, or delete graph data and bypass logical group isolation.","solution":"Fixed in 0.28.2. Upgrade to 0.28.2 or later, which adds validation of SearchFilters.node_labels, label validation in shared search-filter constructors, validation of entity node labels in persistence query builders, and validation of group_ids in shared search fulltext helpers. If upgrading is not possible: do not expose Graphiti MCP tools to untrusted users or to LLM workflows processing untrusted prompt content, avoid passing untrusted values into SearchFilters.node_labels or MCP entity_types, and restrict graph database credentials to the minimum required privileges.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-gg5m-55jj-8m5g","publishedAt":"2026-03-12T17:26:16.000Z","cveId":"CVE-2026-32247","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["graphiti-core@<= 0.28.1 (fixed: 0.28.2)"],"affectedPackageNames":["graphiti-core"],"affectedPackageRefs":["pypi:graphiti-core"],"affectedVendors":[],"affectedVendorsRaw":["Graphiti","Graphiti MCP Server","Neo4j","FalkorDB","Neptune","Kuzu"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00358,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-gg5m-55jj-8m5g"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-12T17:26:16.000Z","fixReleasedAt":"2026-03-11T16:20:01.037Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:39:54.089Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"graphiti-core","fixedVersion":"0.28.2","matchedVersion":"0.28.2","fixReleasedAt":"2026-03-11T16:20:01.037Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:53.931Z"}]}}